Ruby OpenID (aka ruby-openid) through 2.8.0 has a remotely exploitable flaw. This library is used by Rails web applications to integrate with OpenID Providers. Severity can range from medium to critical, depending on how a web application developer chose to employ the ruby-openid library. Developers who based their OpenID integration heavily on the "example app" provided by the project are at highest risk.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Ruby OpenID (aka ruby-openid) through 2.8.0 has a remotely exploitable flaw. This library is used by Rails     web applications to integrate with OpenID Providers. Severity can range from medium to critical, depending     on how a web application developer chose to employ the ruby-openid library. Developers who based their     OpenID integration heavily on the example app provided by the project are at highest risk.
    (CVE-2019-11027)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Ruby OpenID (aka ruby-openid) through 2.8.0 has a remotely exploitable flaw. This library is used by Rails
    web applications to integrate with OpenID Providers. Severity can range from medium to critical, depending
    on how a web application developer chose to employ the ruby-openid library. Developers who based their
    OpenID integration heavily on the "example app" provided by the project are at highest risk.
    (CVE-2019-11027)

The remote host is affected by the vulnerability described in GLSA-202003-09 (OpenID library for Ruby: Server-Side Request Forgery)

    It was discovered that OpenID library for Ruby performed discovery       first, and then verification.
  Impact :

    A remote attacker could possibly change the URL used for discovery and       trick the server into connecting to the URL. This server in turn could be       a private server not       publicly accessible.
    In addition, if the client that uses this library discloses connection       errors, this in turn could disclose information from the private server       to the attacker.
  Workaround :

    There is no known workaround at this time.

ruby-openid performed discovery first, and then verification. This allowed an attacker to change the URL used for discovery and trick the server into connecting to the URL. This server in turn could be a private server not publicly accessible.

Furthermore, if the client that uses this library discloses connection errors, this in turn could disclose information from the private server to the attacker.

For Debian 8 'Jessie', this problem has been fixed in version 2.5.0debian-1+deb8u1.

We recommend that you upgrade your ruby-openid packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
258807	Linux Distros Unpatched Vulnerability : CVE-2019-11027	Nessus	Misc.	critical
422109	SCA: security update for ruby-openid (GHSA-fqfj-cmh6-hj49)	Tenable Cloud Security	SCA Checks	critical
422109	SCA: security update for ruby-openid (GHSA-fqfj-cmh6-hj49)	Tenable Self-Hosted Container Security	SCA Checks	critical
134586	GLSA-202003-09 : OpenID library for Ruby: Server-Side Request Forgery	Nessus	Gentoo Local Security Checks	critical
129801	Debian DLA-1956-1 : ruby-openid security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2019-11027

critical

Tenable Plugins

critical

critical

critical

critical

critical